# CVEs published 2018-03-06

58 CVEs were published on March 6, 2018: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2016-5179](https://cve.now/CVE-2016-5179.md): Chrome OS before 53.0.2785.144 allows remote attackers to execute arbitrary commands at boot. (no CVSS)
- [CVE-2016-7443](https://cve.now/CVE-2016-7443.md): Exponent CMS 2.3.0 through 2.3.9 allows remote attackers to have unspecified impact via vectors related to "uploading files to wrong locatio (no CVSS)
- [CVE-2017-11649](https://cve.now/CVE-2017-11649.md): Cross-site request forgery (CSRF) vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0\_RC3 build r6594 allows remote attackers (no CVSS)
- [CVE-2017-11650](https://cve.now/CVE-2017-11650.md): Cross-site scripting (XSS) vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0\_RC3 build r6594 allows remote attackers to inje (no CVSS)
- [CVE-2018-7738](https://cve.now/CVE-2018-7738.md): In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name (no CVSS)
- [CVE-2018-7739](https://cve.now/CVE-2018-7739.md): antsle antman before 0.9.1a allows remote attackers to bypass authentication via invalid characters in the username and password parameters, (no CVSS)
- [CVE-2018-5461](https://cve.now/CVE-2018-5461.md): An Inadequate Encryption Strength issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Class (no CVSS, Hirschmann Automation and Control GmbH Classic Platform Swi…)
- [CVE-2018-5465](https://cve.now/CVE-2018-5465.md): A Session Fixation issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Swi (no CVSS, Hirschmann Automation and Control GmbH Classic Platform Swi…)
- [CVE-2018-5467](https://cve.now/CVE-2018-5467.md): An Information Exposure Through Query Strings in GET Request issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH (no CVSS, Hirschmann Automation and Control GmbH Classic Platform Swi…)
- [CVE-2018-5469](https://cve.now/CVE-2018-5469.md): An Improper Restriction of Excessive Authentication Attempts issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH (no CVSS, Hirschmann Automation and Control GmbH Classic Platform Swi…)
- [CVE-2018-5471](https://cve.now/CVE-2018-5471.md): A Cleartext Transmission of Sensitive Information issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, a (no CVSS, Hirschmann Automation and Control GmbH Classic Platform Swi…)
- [CVE-2018-7736](https://cve.now/CVE-2018-7736.md): In Z-BlogPHP 1.5.1.1740, cmd.php has XSS via the ZC\_BLOG\_SUBNAME parameter or ZC\_UPLOAD\_FILETYPE parameter. (no CVSS)
- [CVE-2018-7737](https://cve.now/CVE-2018-7737.md): In Z-BlogPHP 1.5.1.1740, there is Web Site physical path leakage, as demonstrated by admin\_footer.php or admin\_footer.php. (no CVSS)
- [CVE-2015-5377](https://cve.now/CVE-2015-5377.md): Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol. (no CVSS)
- [CVE-2017-15519](https://cve.now/CVE-2017-15519.md): Versions of SnapCenter 2.0 through 3.0.1 allow unauthenticated remote attackers to view and modify backup related data via the Plug-in for N (no CVSS, NetApp SnapCenter)
- [CVE-2018-1343](https://cve.now/CVE-2018-1343.md): PAM exposure enabling unauthenticated access to remote host (no CVSS, Micro Focus NetIQ Privileged Account Manager (PAM) 3.1 and)
- [CVE-2018-5729](https://cve.now/CVE-2018-5729.md): MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of ser (no CVSS)
- [CVE-2018-5730](https://cve.now/CVE-2018-5730.md): MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN conta (no CVSS)
- [CVE-2018-6019](https://cve.now/CVE-2018-6019.md): Samsung Display Solutions App before 3.02 for Android allows man-in-the-middle attackers to spoof B2B content by leveraging failure to use e (no CVSS)
- [CVE-2018-6527](https://cve.now/CVE-2018-6527.md): XSS vulnerability in htdocs/webinc/js/adv\_parent\_ctrl\_map.php in D-Link DIR-868L DIR868LA1\_FW112b04 and previous versions, DIR-865L DIR-865L (no CVSS)
- [CVE-2018-6528](https://cve.now/CVE-2018-6528.md): XSS vulnerability in htdocs/webinc/body/bsc\_sms\_send.php in D-Link DIR-868L DIR868LA1\_FW112b04 and previous versions, DIR-865L DIR-865L\_REVA (no CVSS)
- [CVE-2018-6529](https://cve.now/CVE-2018-6529.md): XSS vulnerability in htdocs/webinc/js/bsc\_sms\_inbox.php in D-Link DIR-868L DIR868LA1\_FW112b04 and previous versions, DIR-865L DIR-865L\_REVA\_ (no CVSS)
- [CVE-2018-6530](https://cve.now/CVE-2018-6530.md): OS command injection vulnerability in soap.cgi (soapcgi\_main in cgibin) in D-Link DIR-880L DIR-880L\_REVA\_FIRMWARE\_PATCH\_1.08B04 and previous (CVSS 9.8, KEV)
- [CVE-2018-6808](https://cve.now/CVE-2018-6808.md): NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11.1, and 12.0 allow remote attackers to download arbitrary file (no CVSS)
- [CVE-2018-6809](https://cve.now/CVE-2018-6809.md): NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11.1, and 12.0 allow remote attackers to gain privilege on a tar (no CVSS)
- [CVE-2018-6810](https://cve.now/CVE-2018-6810.md): Directory traversal vulnerability in NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11.1, and 12.0 allows remot (no CVSS)
- [CVE-2018-6811](https://cve.now/CVE-2018-6811.md): Multiple cross-site scripting (XSS) vulnerabilities in Citrix NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11 (no CVSS)
- [CVE-2018-7170](https://cve.now/CVE-2018-7170.md): ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitraril (no CVSS)
- [CVE-2018-7182](https://cve.now/CVE-2018-7182.md): The ctl\_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via (no CVSS)
- [CVE-2018-7184](https://cve.now/CVE-2018-7184.md): ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a den (no CVSS)
- [CVE-2018-7185](https://cve.now/CVE-2018-7185.md): The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending (no CVSS)
- [CVE-2018-7734](https://cve.now/CVE-2018-7734.md): Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter i (no CVSS)
- [CVE-2018-7735](https://cve.now/CVE-2018-7735.md): Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter i (no CVSS)
- [CVE-2018-7728](https://cve.now/CVE-2018-7728.md): An issue was discovered in Exempi through 2.4.4. (no CVSS)
- [CVE-2018-7729](https://cve.now/CVE-2018-7729.md): An issue was discovered in Exempi through 2.4.4. (no CVSS)
- [CVE-2018-7730](https://cve.now/CVE-2018-7730.md): An issue was discovered in Exempi through 2.4.4. (no CVSS)
- [CVE-2018-7731](https://cve.now/CVE-2018-7731.md): An issue was discovered in Exempi through 2.4.4. (no CVSS)
- [CVE-2018-7732](https://cve.now/CVE-2018-7732.md): An issue was discovered in YxtCMF 3.1. (no CVSS)
- [CVE-2018-7733](https://cve.now/CVE-2018-7733.md): An issue was discovered in YxtCMF 3.1. (no CVSS)
- [CVE-2018-1000100](https://cve.now/CVE-2018-1000100.md): GPAC MP4Box version 0.7.1 and earlier contains a Buffer Overflow vulnerability in src/isomedia/avc\_ext.c lines 2417 to 2420 that can result (no CVSS)
- [CVE-2018-1000101](https://cve.now/CVE-2018-1000101.md): Mingw-w64 version 5.0.3 and earlier, 5.0.4, 6.0.0 and 7.0.0 contains an Improper Null Termination (CWE-170) vulnerability in mingw-w64-crt ( (no CVSS)
- [CVE-2018-7722](https://cve.now/CVE-2018-7722.md): The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /ws.php?format=json request. (no CVSS)
- [CVE-2018-7723](https://cve.now/CVE-2018-7723.md): The management panel in Piwigo 2.9.3 has stored XSS via the virtual\_name parameter in a /admin.php?page=cat\_list request, a different issue (no CVSS)
- [CVE-2018-7724](https://cve.now/CVE-2018-7724.md): The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /admin.php?page=photo-${photo\_number} request. (no CVSS)
- [CVE-2018-7725](https://cve.now/CVE-2018-7725.md): An issue was discovered in ZZIPlib 0.13.68. (no CVSS)
- [CVE-2018-7726](https://cve.now/CVE-2018-7726.md): An issue was discovered in ZZIPlib 0.13.68. (no CVSS)
- [CVE-2018-7727](https://cve.now/CVE-2018-7727.md): An issue was discovered in ZZIPlib 0.13.68. (no CVSS)
- [CVE-2017-6280](https://cve.now/CVE-2017-6280.md): NVIDIA driver contains a possible out-of-bounds read vulnerability due to a leak which may lead to information disclosure. (no CVSS, Nvidia Android)
- [CVE-2017-6282](https://cve.now/CVE-2017-6282.md): NVIDIA Tegra kernel driver contains a vulnerability in NVMAP where an attacker has the ability to write an arbitrary value to an arbitrary l (no CVSS, Nvidia SHIELD TV)
- [CVE-2017-6283](https://cve.now/CVE-2017-6283.md): NVIDIA Security Engine contains a vulnerability in the RSA function where the keyslot read/write lock permissions are cleared on a chip rese (no CVSS, Nvidia SHIELD TV)
- [CVE-2017-6284](https://cve.now/CVE-2017-6284.md): NVIDIA Security Engine contains a vulnerability in the Deterministic Random Bit Generator (DRBG) where the DRBG does not properly initialize (no CVSS, Nvidia SHIELD TV)
- [CVE-2017-6295](https://cve.now/CVE-2017-6295.md): NVIDIA TrustZone Software contains a vulnerability in the Keymaster implementation where the software reads data past the end, or before the (no CVSS, Nvidia SHIELD TV)
- [CVE-2017-6296](https://cve.now/CVE-2017-6296.md): NVIDIA TrustZone Software contains a TOCTOU issue in the DRM application which may lead to the denial of service or possible escalation of p (no CVSS, Nvidia SHIELD TV)
- [CVE-2017-9783](https://cve.now/CVE-2017-9783.md): Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote (no CVSS)
- [CVE-2017-9786](https://cve.now/CVE-2017-9786.md): Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote (no CVSS)
- [CVE-2018-1062](https://cve.now/CVE-2018-1062.md): A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks (no CVSS, oVirt)
- [CVE-2018-7307](https://cve.now/CVE-2018-7307.md): The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter. (no CVSS, auth0-js)
- [CVE-2018-7650](https://cve.now/CVE-2018-7650.md): PHP Scripts Mall Hot Scripts Clone:Script Classified Version 3.1 Application is vulnerable to stored XSS within the "Add New" function for a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-03-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.